Description
An access-control flaw was found in the OpenStack Designate component where private configuration information including access keys to BIND were improperly made world readable. A malicious attacker with access to any container could exploit this flaw to access sensitive information.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | Red Hat OpenStack Platform 17.1 for RHEL 8 | — | — |
| Red Hat | Red Hat OpenStack Platform 17.1 for RHEL 9 | — | — |
| Red Hat | Red Hat OpenStack Platform 16.1 | — | — |
| Red Hat | Red Hat OpenStack Platform 16.2 | — | — |
| Red Hat | Red Hat OpenStack Platform 17.1 | — | — |
| Red Hat | Red Hat OpenStack Platform 18.0 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenStack 17 | openstack-tripleo-heat-templates | 14.3.1-17.1.20231103003762.el8ost | RHSA-2024:2770, RHSA-2024:2736 |
| Red Hat OpenStack 17 | tripleo-ansible | 3.3.1-17.1.20231101230831.el9ost | RHSA-2024:2770, RHSA-2024:2736 |
Advisories 4
- WID-SEC-2024-1228 Red Hat OpenStack: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 15, 2026
- RHSA-2024:2770 Red Hat Security Advisory: Red Hat OpenStack Platform 17.1 (tripleo-ansible and openstack-tripleo-heat-templates) security update Red Hat Security Advisories (RHSA) · Feb 26, 2026
- RHSA-2024:2736 Red Hat Security Advisory: openstack-tripleo-heat-templates and tripleo-ansible update Red Hat Security Advisories (RHSA) · Feb 26, 2026
- WID-SEC-2024-0653 Red Hat OpenStack: Schwachstelle ermöglicht Offenlegung von Informationen BSI CERT-Bund (WID) · Mar 17, 2024
References
- RHSA-2024:2736 vendor-advisory
- RHSA-2024:2770 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2023-6725 vdb-entry
- RHBZ#2249273 issue-tracking